SC-100 Practice Test 2 — 25 Questions

Question 1

A company is implementing a Zero Trust network strategy using Azure Virtual Network Manager (AVNM). They need to ensure that all traffic between virtual networks is encrypted and inspected by a firewall. Which configuration should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a hub-and-spoke topology with a firewall appliance in the hub. In a Zero Trust network strategy, all traffic must be encrypted and inspected regardless of source. A hub-and-spoke topology with a firewall appliance in the hub forces all inter-VNet traffic through the firewall, enabling deep packet inspection and encryption enforcement. Azure Virtual Network Manager (AVNM) can deploy this topology and route traffic via the hub, ensuring no direct VNet-to-VNet communication bypasses inspection.

Answer

Enable VNet peering between all VNets and use network security groups

Answer

Use a mesh topology with direct connectivity between VNets

Answer

Configure service endpoints for each VNet

Question 2

A company uses Microsoft Defender for Cloud to assess compliance with Azure Security Benchmark (ASB). The security team wants to ensure that all recommendations are being followed. Which three actions should the team take to manage and remediate recommendations effectively?

Accepted Answer

Enable continuous export of compliance data to Log Analytics or Event Hubs.. Enabling continuous export of compliance data to Log Analytics or Event Hubs allows the security team to centralize, query, and monitor compliance data over time. This is essential for tracking the status of all Azure Security Benchmark recommendations, creating custom alerts, and integrating with SIEM or automation workflows. Option C is correct because creating exemption rules for resources that are compliant by other means (e.g., via a third-party tool or compensating controls) prevents false positives and reduces alert fatigue while maintaining accurate compliance posture. Option D is correct because enabling automatic provisioning of the Log Analytics agent ensures that all supported VMs are monitored and can report their compliance status, which is a foundational requirement for many ASB recommendations. Options B and E are incorrect: manual monthly remediation is not scalable or continuous, and disabling recommendations should be done via exemptions rather than outright disabling to maintain auditability.

Answer

Manually remediate all high-severity recommendations each month.

Answer

Disable recommendations that are not applicable to the environment.

Question 3

A company plans to implement a Zero Trust security model. Which of the following is the primary principle that should guide their strategy?

Accepted Answer

Assume breach and verify explicitly. The primary principle of Zero Trust is 'never trust, always verify,' which is operationalized as 'assume breach and verify explicitly.' This means every access request—regardless of source (internal or external)—must be authenticated, authorized, and encrypted before granting access. It eliminates implicit trust based on network location and enforces least-privilege access, which is foundational to the Zero Trust architecture.

Answer

Use a strong perimeter firewall as the primary defense

Answer

Grant trusted users full access to all resources

Answer

Trust but verify all internal traffic

Question 4

Which THREE capabilities are provided by Microsoft Defender for Cloud Apps (MDA) when integrated with Microsoft Defender XDR?

Accepted Answer

Discovery of shadow IT cloud apps.. Microsoft Defender for Cloud Apps (MDA) integrates with Microsoft Defender XDR to provide shadow IT discovery by analyzing traffic logs from network devices and cloud app catalogs, identifying unsanctioned cloud applications used in the organization. This capability is core to MDA's Cloud Discovery feature, which uses log parsing and machine learning to detect and classify shadow IT.

Answer

Email protection against phishing and malware.

Answer

Endpoint detection and response (EDR) for devices.

Question 5

Your organization is implementing Microsoft Defender for Identity to protect on-premises Active Directory. Which THREE activities does Defender for Identity monitor?

Accepted Answer

Privilege escalation attempts. Correct answers: A, B, D. Defender for Identity monitors privilege escalation attempts (A) by detecting suspicious changes in user privileges. Lateral movement paths using Pass-the-Hash (B) are detected by analyzing network activity and authentication patterns. Reconnaissance attacks using LDAP queries (D) are identified by unusual LDAP search patterns. Option C is incorrect: file integrity changes on domain controllers are monitored by Defender for Servers or Azure Policy, not Defender for Identity. Option E is incorrect: network traffic to external IP addresses is monitored by Defender for Network or network security groups, not Defender for Identity.

Answer

File integrity changes on domain controllers

Answer

Network traffic to external IP addresses

Question 6

A company uses Microsoft Entra ID for identity management. They want to ensure that only managed devices can access corporate email. Which Conditional Access policy setting should be configured?

Accepted Answer

Require device to be marked as compliant. To ensure only managed devices can access corporate email, you need to enforce device compliance. The Conditional Access policy setting 'Require device to be marked as compliant' checks that the device is enrolled in Microsoft Intune and meets all compliance policies (e.g., encryption, OS version, jailbreak detection) before granting access. This directly restricts access to managed devices only.

Answer

Require multifactor authentication

Answer

Block legacy authentication

Answer

Require approved client app

Question 7

Your organization uses Microsoft Purview Information Protection and Microsoft Defender for Cloud Apps. You need to design a solution that automatically applies a 'Confidential' sensitivity label to documents that contain credit card numbers and are shared externally. The solution should also generate an alert when this occurs. Which two configurations should you implement? (Choose TWO.)

Accepted Answer

Create a Microsoft Purview auto-labeling policy that includes the 'Credit Card Number' sensitive info type and specifies the 'Confidential' label.. Options D and E are correct because an auto-labeling policy in Microsoft Purview can scan for sensitive info types (credit card numbers) and automatically apply the 'Confidential' label to documents. A Microsoft Defender for Cloud Apps app governance policy can monitor file sharing and trigger an alert when a document with the 'Confidential' label is shared externally. Option A (Microsoft Sentinel analytics rule) could generate alerts but is not the primary mechanism for labeling, and option B (Conditional Access) controls access, not labeling. Option C (Data Loss Prevention) is for blocking, not labeling.

Answer

Configure a Microsoft Sentinel analytics rule that queries audit logs for external sharing of labeled documents and generates an incident.

Answer

Create a Conditional Access policy in Microsoft Entra ID that requires device compliance when accessing documents labeled 'Confidential'.

Answer

Configure a Microsoft Purview Data Loss Prevention (DLP) policy that blocks the sharing of documents containing credit card numbers.

Question 8

Your company uses Microsoft Defender for Cloud to secure Azure workloads. You need to ensure that all storage accounts have the 'Secure transfer required' setting enabled. What should you use?

Accepted Answer

Azure Policy. Azure Policy can audit and enforce the 'Secure transfer required' setting across all storage accounts. Option A (RBAC) is incorrect because RBAC controls access permissions, not resource configuration. Option B (Azure Blueprints) is deprecated and not the direct solution for this requirement. Option C (Microsoft Defender for Cloud regulatory compliance dashboard) provides visibility but does not enforce settings.

Answer

Azure role-based access control (RBAC)

Answer

Azure Blueprints

Answer

Microsoft Defender for Cloud regulatory compliance dashboard

Question 9

A company is implementing a Zero Trust identity strategy. They want to ensure that only compliant and managed devices can access corporate resources. Which THREE components should they include in their solution? (Choose three.)

Accepted Answer

Microsoft Intune for device management and compliance policies. A is correct because Microsoft Intune provides device management and compliance policies that define the security posture required for managed devices, such as requiring encryption, a minimum OS version, or a specific patch level. These compliance policies are evaluated by Azure AD during authentication, ensuring only devices that meet the organization's security standards can access corporate resources.

Answer

Azure AD Application Proxy

Answer

Azure AD B2B collaboration

Question 10

Your organization is adopting a Zero Trust security model. You need to design a solution that ensures continuous verification of user identity and device health before granting access to resources. Which Microsoft Entra ID feature should you prioritize?

Accepted Answer

Microsoft Entra ID Conditional Access. Conditional Access is the primary Microsoft Entra ID feature that enforces continuous verification by evaluating user identity, device health (via compliance policies or Microsoft Defender for Endpoint signals), location, and risk in real-time before granting access. It directly supports the Zero Trust principle of 'never trust, always verify' by requiring authentication and authorization at every access attempt, not just at the perimeter.

Answer

Microsoft Entra ID Domain Services

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Question 11

You are a security architect for a large financial services company. The company has a hybrid identity environment with on-premises Active Directory synchronized to Microsoft Entra ID using Microsoft Entra Connect. They use Microsoft 365 E5 licenses and have deployed Microsoft Defender for Cloud, Microsoft Defender for Identity, Microsoft Sentinel, and Microsoft Purview. The company has recently suffered a ransomware attack where an attacker gained access via a compromised service account that had permanent Global Administrator privileges. The attacker then used the account to create a backdoor user and exfiltrate sensitive data from SharePoint Online. After the incident, the CISO mandates a Zero Trust security transformation with the following requirements: 
1. Eliminate standing privileged access for all cloud admins.
2. Require phishing-resistant authentication for all privileged roles.
3. Ensure that all sensitive data in SharePoint Online is automatically classified and protected.
4. Enable detection of lateral movement using anomalous behavior analytics. Which combination of actions should you recommend?

Accepted Answer

Implement Privileged Identity Management (PIM) for Global Administrator roles, configure Authentication Strengths to require FIDO2, create auto-labeling policies for credit card numbers, and enable Defender for Identity lateral movement path detection.. It directly addresses all four CISO requirements: Privileged Identity Management (PIM) eliminates standing Global Administrator privileges by requiring just-in-time activation; Authentication Strengths with FIDO2 enforces phishing-resistant authentication for privileged roles; auto-labeling policies in Microsoft Purview automatically classify and protect sensitive data like credit card numbers in SharePoint Online; and Defender for Identity lateral movement path detection uses behavioral analytics to detect anomalous lateral movement, fulfilling the detection requirement.

Answer

Deploy Microsoft Entra Identity Protection for all users, configure Azure AD Conditional Access with MFA, use Microsoft Purview Information Protection with manual labeling, and enable Microsoft Sentinel analytics for lateral movement.

Answer

Configure Conditional Access to require MFA for admins, enable Microsoft Purview DLP for SharePoint, deploy Defender for Cloud Apps, and use Identity Protection for user risk.

Answer

Remove all permanent admin roles and use just-in-time access via PIM, enforce MFA via Conditional Access, apply sensitivity labels via Microsoft Purview Data Map, and use Microsoft Defender for Cloud for network security groups.

Question 12

Your organization uses Microsoft Sentinel and wants to correlate security events from multiple sources to detect multi-stage attacks. What should you create?

Accepted Answer

Fusion rule. Fusion rules in Microsoft Sentinel are specifically designed to correlate security events from multiple sources and detect multi-stage attacks by combining alerts from different detection technologies into a single incident. This matches the requirement to correlate events across sources for complex attack chains, unlike other rule types that focus on single-source or single-event detection.

Answer

Scheduled query rule

Answer

NRT rule

Answer

Anomaly rule

Question 13

A company uses Azure DevOps and wants to implement a DevSecOps practice by scanning code for secrets and vulnerabilities before deployment. Which tool should they integrate into their pipeline?

Accepted Answer

Microsoft Defender for DevOps. Microsoft Defender for DevOps is the correct choice because it is a unified DevSecOps solution that integrates directly into Azure DevOps pipelines to scan code for secrets, vulnerabilities, and open-source dependencies before deployment. It provides actionable security insights and remediation guidance, aligning with the requirement to implement a DevSecOps practice by scanning code for secrets and vulnerabilities.

Answer

Azure Policy

Answer

Microsoft Purview

Answer

GitHub Advanced Security

Question 14

A company is designing a security strategy for their AI-powered applications using Microsoft Azure OpenAI Service. They need to ensure that the AI models are not used to generate harmful content and that the data sent to the models is protected. Which Microsoft Purview feature should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) for AI. Microsoft Purview Data Loss Prevention (DLP) for AI is the correct feature because it is specifically designed to monitor and control the data sent to and from AI applications, including Azure OpenAI Service, to prevent the generation of harmful content and protect sensitive data. It uses deep content analysis and policy-based controls to detect and block policy violations in real-time, directly addressing the dual requirements of content safety and data protection.

Answer

Microsoft Purview Endpoint DLP

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Audit

Question 15

A company uses Azure App Service to host a web application that stores sensitive data in Azure SQL Database. The security team requires that data at rest in the database be encrypted using a customer-managed key stored in Azure Key Vault. The key must be rotated automatically every 90 days. What is the recommended approach to meet these requirements?

Accepted Answer

Enable TDE with customer-managed keys in Azure Key Vault and set a key rotation policy in Key Vault to rotate the key every 90 days.. Transparent Data Encryption (TDE) with customer-managed keys (CMK) in Azure Key Vault meets the requirement for encrypting data at rest in Azure SQL Database using a key controlled by the customer. Azure Key Vault supports automatic key rotation policies that can be set to rotate the key every 90 days, satisfying the rotation requirement without manual intervention or application code changes.

Answer

Encrypt sensitive columns using cell-level encryption with keys stored in Azure Key Vault and rotate keys manually every 90 days.

Answer

Enable Transparent Data Encryption (TDE) with service-managed keys in Azure SQL Database.

Answer

Use Always Encrypted with column master keys stored in Azure Key Vault and configure key rotation in the application code.

Question 16

A company is designing a defense-in-depth strategy for their Azure environment. They want to ensure that if a virtual machine is compromised, the attacker cannot move laterally to other VMs in the same virtual network. Which security control should they prioritize?

Accepted Answer

Implement network segmentation using NSGs and application security groups. Network segmentation using NSGs and application security groups is the correct priority because it directly controls east-west traffic between VMs within the same virtual network. By defining explicit inbound and outbound rules that restrict communication to only necessary ports and protocols (e.g., TCP 443 for HTTPS), an attacker who compromises one VM cannot initiate lateral movement to other VMs, as the NSG will drop unauthorized traffic at the subnet or NIC level.

Answer

Enable Azure DDoS Protection on the virtual network

Answer

Enable multi-factor authentication (MFA) for all admin accounts

Answer

Deploy Azure Bastion for secure remote access

Question 17

Tailwind Traders is a small business that uses Microsoft 365 Business Premium. They have no dedicated IT staff. The owner wants to implement basic security measures to protect against common threats like phishing, ransomware, and unauthorized access. They need a simple, cost-effective solution that aligns with Microsoft's security best practices for small businesses. Which set of actions should you recommend?

Accepted Answer

Enable Security Defaults in Microsoft Entra ID to enforce MFA for all users. Configure Microsoft Defender for Office 365 to protect against phishing and malware. Use Microsoft Defender for Business (included) for endpoint protection. Regularly review the Microsoft 365 Secure Score and implement top recommendations.. It aligns with Microsoft's security best practices for small businesses with no dedicated IT staff. Security Defaults in Microsoft Entra ID provide a baseline of MFA enforcement without requiring complex configuration. Microsoft Defender for Office 365 and Defender for Business (included in Microsoft 365 Business Premium) offer integrated phishing, malware, and endpoint protection. Regularly reviewing the Secure Score ensures continuous improvement against common threats like ransomware and unauthorized access.

Answer

Implement Privileged Identity Management (PIM) for all accounts. Use Azure Information Protection to classify all emails. Set up a SIEM using Microsoft Sentinel.

Answer

Deploy Microsoft Intune to manage devices. Configure Conditional Access policies to require compliant devices. Use Microsoft Defender for Endpoint for antivirus. Set up a VPN for remote access.

Answer

Purchase Azure AD Premium P2 for all users. Use Identity Protection to detect risks. Configure Conditional Access with session controls. Use Azure AD Identity Governance for access reviews.

Question 18

A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They want to prevent users from sharing credit card numbers in email but allow sharing via encrypted email. What should they configure?

Accepted Answer

Configure a DLP rule that blocks sharing unless the email is encrypted, with user override. Microsoft Purview DLP can enforce a policy that blocks sharing of credit card numbers unless the email is encrypted, with a user override option to allow legitimate encrypted sharing. This directly meets the requirement to prevent unencrypted sharing while permitting encrypted email transmission, leveraging DLP's ability to inspect email content and conditionally apply actions based on encryption status.

Answer

Assign a sensitivity label that encrypts the email automatically

Answer

Create a Microsoft Purview Message Encryption policy

Answer

Use Exchange mail flow rules to block unencrypted credit card data

Question 19

Your organization is migrating to Microsoft 365 and wants to implement a defense-in-depth strategy for email security. Which combination of Microsoft services should you use?

Accepted Answer

Microsoft Defender for Office 365 and Exchange Online Protection. Defense-in-depth for email security requires layered protection at the transport, filtering, and post-delivery stages. Exchange Online Protection (EOP) provides baseline anti-malware, anti-spam, and transport rules, while Microsoft Defender for Office 365 adds advanced threat protection like Safe Attachments, Safe Links, and anti-phishing policies that inspect URLs and attachments in real time. Together, they cover the full email threat chain from ingress to user interaction.

Answer

Microsoft Purview Compliance Manager and Microsoft Defender for Cloud Apps

Answer

Microsoft Intune and Microsoft Entra ID

Answer

Microsoft Sentinel and Microsoft Defender for Identity

Question 20

Which TWO configurations are required to enable Microsoft Defender for Cloud Apps to monitor cloud app usage?

Accepted Answer

Add app connectors for the cloud apps you want to monitor. A is correct because Microsoft Defender for Cloud Apps requires app connectors to establish API-based connections with cloud applications (e.g., Office 365, Salesforce, AWS). These connectors enable the service to ingest activity logs, file metadata, and user sessions for monitoring and threat detection. Without app connectors, Defender for Cloud Apps cannot access the cloud app's data plane to perform its core monitoring functions.

Answer

Configure Microsoft Intune device compliance policies

Answer

Deploy Azure Information Protection scanner

Answer

Synchronize with Microsoft Entra ID